Minimal APR-Aligned Incident Response Playbook Defender-Chain Compromise: Identity Trust Collapse, Boundary Inversion, and Substrate Integrity Restoration

Defender-chain compromise—the class of attack in which the Windows Defender security substrate is tampered with to blind the defender before lateral movement and identity abuse proceed—requires an incident response approach that is substrate-aware, not merely output-aware. Standard IR playbooks focus on containment and eradication of observed malicious activity. Substrate-aware IR recognizes that when the security enforcement layer has been compromised, all telemetry from the affected host is unreliable, and the identity trust fabric may be compromised in ways that extend far beyond the initially observed indicators. This technical note provides a minimal APR-aligned IR playbook organized around three substrate domains—identity trust (APR-1), internal trust boundaries (APR-2), and OS/kernel substrate integrity (APR-3)—with detection indicators, containment actions, and identity remediation steps for each. It concludes with a four-phase identity-forensics post-mortem framework covering materialization, replay, propagation, and persistence—the phases most IR teams address incompletely.